From 09553f5c42d2f6fdb5b60852a7671ba6077d5c8f Mon Sep 17 00:00:00 2001
From: kitos <kitos@aegis.local>
Date: Wed, 15 Jul 2026 14:16:27 +0200
Subject: [PATCH] fix(users): add manager to the valid-role whitelist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'manager' has been a fully-functional role throughout the app —
notifications, operator assignment, dispute mediation — but was
missing from both the user creation/update whitelist and the SSO
auto-provisioning role list, so a manager account could never
actually be created.
---
 backend/app/services/sso_service.py       |  2 +-
 backend/app/services/user_service.py      |  4 +--
 backend/tests/test_user_api_validation.py | 32 +++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/backend/app/services/sso_service.py b/backend/app/services/sso_service.py
index a108c70..7829050 100644
--- a/backend/app/services/sso_service.py
+++ b/backend/app/services/sso_service.py
@@ -202,7 +202,7 @@ def process_callback(db: Session, request_data: dict) -> User:
     )
 
     # Validate role
-    valid_roles = {"admin", "red_lead", "blue_lead", "red_tech", "blue_tech", "viewer"}
+    valid_roles = {"admin", "red_lead", "blue_lead", "red_tech", "blue_tech", "manager", "viewer"}
     if role not in valid_roles:
         log.warning("SSO: unknown role '%s' for user '%s', falling back to default", role, username)
         role = cfg.default_role or "viewer"
diff --git a/backend/app/services/user_service.py b/backend/app/services/user_service.py
index dc735c4..f21d14a 100644
--- a/backend/app/services/user_service.py
+++ b/backend/app/services/user_service.py
@@ -26,8 +26,8 @@ from app.domain.errors import (
 # Import User from app.models.user
 from app.models.user import User
 
-# Assign VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewer"}
-VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "viewer"}
+# Assign VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "manager", "viewer"}
+VALID_ROLES = {"admin", "red_tech", "blue_tech", "red_lead", "blue_lead", "manager", "viewer"}
 
 
 # Define function list_users
diff --git a/backend/tests/test_user_api_validation.py b/backend/tests/test_user_api_validation.py
index f79d418..cbf8b4f 100644
--- a/backend/tests/test_user_api_validation.py
+++ b/backend/tests/test_user_api_validation.py
@@ -57,3 +57,35 @@ def test_create_user_valid_password_accepted(client, admin_user, admin_token):
     )
     assert response.status_code == 201
     assert response.json()["username"] == "validuser99"
+
+
+def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
+    """Regression: 'manager' is a real, actively-used role (dispute mediation,
+    operator assignment) but was missing from the creation whitelist."""
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "newmanager",
+            "password": "ValidPass123!@#",
+            "email": "newmanager@test.com",
+            "role": "manager",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 201, response.text
+    assert response.json()["role"] == "manager"
+
+
+def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
+    response = client.post(
+        "/api/v1/users",
+        json={
+            "username": "badroleuser",
+            "password": "ValidPass123!@#",
+            "email": "badrole@test.com",
+            "role": "superuser",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 400
+    assert "Invalid role" in response.text